Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thanksgiving 2023 security incident

blog.cloudflare.com

Post reply on HN
Print view View original

161–170 of 336 posts

Re: Thanksgiving 2023 security incident

#161

Post by DANmode »

michaelt wrote: post #108
samcat116 wrote: post #46

Earlier quoted context omitted.

> new laptops that are preinstalled with Okta’s management system Okta doesn't make device management software, thats made by companies like Jamf. Okta can integrate with them but Okta isn't what manages your laptop at all. > I wasn’t willing to use Okta’s login system if I have my own personal passwords or keys anywhere on my work computer. Do not do this, its not a personal device.

> Do not do this, its not a personal device. You think nobody's logged into their personal spotify on their work computer? All those guys wearing headphones in the office have brought in CDs to play in their laptop CD drives? And that business traveller away from their partner and kids for a week+ isn't going to video call them? Or watch some netflix in their hotel room in the evening? That's so unrealistic, you coul…

Hiring people who don't understand technology to build your technology: my path to the Fortune 100 List.

Re: Thanksgiving 2023 security incident

#162

Post by 0cf8612b2e1e »

michaelt wrote: post #108
samcat116 wrote: post #46

Earlier quoted context omitted.

> new laptops that are preinstalled with Okta’s management system Okta doesn't make device management software, thats made by companies like Jamf. Okta can integrate with them but Okta isn't what manages your laptop at all. > I wasn’t willing to use Okta’s login system if I have my own personal passwords or keys anywhere on my work computer. Do not do this, its not a personal device.

> Do not do this, its not a personal device. You think nobody's logged into their personal spotify on their work computer? All those guys wearing headphones in the office have brought in CDs to play in their laptop CD drives? And that business traveller away from their partner and kids for a week+ isn't going to video call them? Or watch some netflix in their hotel room in the evening? That's so unrealistic, you coul…

Parent didn’t say nobody used the device for personal actions, only that they refused to do so. Which is the only reasonable stance. Especially for well paid engineers who can trivially afford a dedicated device.

Re: Thanksgiving 2023 security incident

#163

Post by DANmode »

midasuni wrote: post #154
michaelt wrote: post #108

Earlier quoted context omitted.

> Do not do this, its not a personal device. You think nobody's logged into their personal spotify on their work computer? All those guys wearing headphones in the office have brought in CDs to play in their laptop CD drives? And that business traveller away from their partner and kids for a week+ isn't going to video call them? Or watch some netflix in their hotel room in the evening? That's so unrealistic, you coul…

I’ve had company devices for over 20 years. I’m currently on the way back to my hotel. I refuse to carry more than one phone or one laptop, and I sure ain’t brining a personal device into a country I wouldnt go to on vacation.

> I refuse to carry more than one phone or one laptop

Footgun, but maybe tolerable with your chosen threat model.

Re: Thanksgiving 2023 security incident

#164

Post by DANmode »

2devnull wrote: post #147
yjftsjthsd-h wrote: post #43

Earlier quoted context omitted.

> if I have my own personal passwords or keys anywhere on my work computer. Well... don't do that? Why would you ever have personal anything on a work computer?

HR forms require personal information and do not allow anyone to access from anything but a corporate device.

Open smartphone to the relevant information, type the government ID data they're asking for into corporate machine, end.

Re: Thanksgiving 2023 security incident

#165

Post by outworlder »

bredren wrote: post #115
jrockway wrote: post #39

Earlier quoted context omitted.

Yeah. I've dealt with definitely-not-nation-states before, and their pattern was to sign up for free/cheap CI services (CircleCI, Github Actions, that sort of thing) and launch their attacks from there. The VPS thing also sounds very very plausible to me, I figured there was a long tail, but until I was looking up every network that was attacking us, I really had no idea how deep the long tail goes. I now feel like h…

> I now feel like half the world's side hustle is to rent a server that they never update and host a couple of small business websites there. Do you mean people are offering build / host services for small biz, and leaving their servers in such a state they can be owned and used as jump points for intrusion? Reason I ask is long-hosted small business websites are sometimes established with the intent to legitimize so…

> Do you mean people are offering build / host services for small biz, and leaving their servers in such a state they can be owned and used as jump points for intrusion?

Probably not what's happening.

I've tried to build a cloud CI service a while ago. Per their nature, you _have to_ allow arbitrary commands to be run. And you also have to allow outbound connectivity. So you don't need to 'own' anything in order to be dangerous. They will not run with heightened privileges but that's of little help if the target is external.

It is pretty difficult to reliably secure them against being used as a source of attacks as there's a lot you can do that will mimic legitimate traffic. Sure, you can block connections to things like IRC and you can throttle or flag some suspicious traffic. You can't really prevent HTTPS requests from going out. Heck, even SSH is pretty much required if you are allowing access to git.

Generally speaking, a build service provider will try to harden their own services and sandbox anything that is run in order to protect themselves from being compromised. Most providers won't want to be known as a major source of malicious activity, so there's some effort there. AWS and other large providers have more resources and will easily ban your ass, but that doesn't matter if it happens after a successful attack was launched.

Re: Thanksgiving 2023 security incident

#166

Post by DANmode »

2devnull wrote: post #152
_boffin_ wrote: post #128

Earlier quoted context omitted.

Do you have a phone and headphones?

If you use your phone at work, doesn’t that then become discoverable in the legal sense?

Having a cable or radiowaves coming out of your bag or pocket is considered "use", in nonsecured areas?

Re: Thanksgiving 2023 security incident

#167

Post by DANmode »

BytesAndGears wrote: post #47
verve_rat wrote: post #42

Earlier quoted context omitted.

Why do you need personal passwords on your laptop to do your work? I'm not understanding this.

Fair question, but I use a lot of things that are varying degrees of helpful for my work: * personal ChatGPT and copilot subscriptions, since company doesn’t pay for these * Trello account for keeping track of my todo list (following up with people, running deploys) * Obsidian for keeping notes, as a personal knowledge-base (things like technologies and reminders) * Apple account for music, copy/paste, sharing photos…

This all makes perfect sense - but just seems like your employer is too large to be effective, they're not offering you the right tools/you're not demanding them, and you're in an abusive relationship with them - probably because they pay you well enough.

Re: Thanksgiving 2023 security incident

#168

Post by DANmode »

Xeyz0r wrote: post #77
MichaelZuo wrote: post #52

Earlier quoted context omitted.

Why don't you just do those on a second, personal, laptop? Does your workplace restrict you from bringing it in?

Why carry a second laptop when you can log in wherever you need to on your work laptop? It's easier for me to store all my passwords in a password manager and log in to the websites I need from my work laptop.

If raw ease of use dictates your tech decisions, you're eventually gonna have a bad time.

Re: Thanksgiving 2023 security incident

#169

Post by mmaunder »

Thing about a data breach is once the data is out there - source code in this case - it’s out there for good and you have absolutely no control over who gets it. You can do as much post incident hardening as you want, and talk about it as much as you want, but the thing you’re trying to protect against, and blogging about how good you’re getting at preventing, has already happened. Can’t unscramble those eggs.

Re: Thanksgiving 2023 security incident

#170

Post by OJFord »

htrp wrote: post #118
OJFord wrote: post #34

> The one service token and three accounts were not rotated because mistakenly it was believed they were unused. Eh? So why weren't they revoked entirely? I'm sure something's just unsaid there, or lost in communication or something, but as written that doesn't really make sense to me?

blameless post mortem most likely Great call out too > Note that this was in no way an error on the part of AWS, Moveworks or Smartsheet. These were merely credentials which we failed to rotate.

It can still be blameless though? The 'because' makes it sound like that's a correct reason to leave it; that the only error was thinking they were unused. (i.e. that it's fine to leave them if unused, only a problem if they're used)

i.e. instead of 'because they were mistakenly thought to be unused' you can say 'because they were mistakenly thought to be ok to leave as unused' (or something less awkward depending on exactly what the scenario was) and there's no more blame there? And if you really want to emphasise blamelessness you can say how your processes and training failed to sufficiently encourage least privilege, etc.

Post reply on HN